Wedge spec: compliance-audit — Wedge core — Regulation + Attestation schemas, audit-pack export

[rubenvdlinde]

Spec

openspec/changes/compliance-audit/ — per WEDGE-PLAN.md, Phase 1 wedge.

• proposal.md — scope + risks
• specs/compliance-audit/spec.md — RFC-2119 requirements + GIVEN/WHEN/THEN
• design.md — declarative-first per ADR-022/024/031
• tasks.md — register-patch + manifest tasks

ADRs (foundational, all accepted)

• Scholiq local: ADR-002 (cmi5+xAPI), ADR-005 (EU AI Act gate), ADR-008 (consume OR audit-trail)
• Hydra org-wide: ADR-022 (consume OR), ADR-024 (manifest), ADR-031 (schema-declarative)

Blocks

This spec depends on declarative extensions not yet shipped:

• Scholiq wedge dependencies: appendOnly, tenant-key API, calculatedChange, idempotencyKey, dateDiff, alsoDispatchLifecycle, widget-ref aggregations openregister#1470 (schema extensions: appendOnly, tenant-key API, calculatedChange, idempotencyKey, dateDiff, alsoDispatchLifecycle, cross-schema aggregations) — REQUIRED before Hydra dispatches builder
• Manifest schema extensions: widget-ref, roleAware page resolver, visibleIf.appInstalled nextcloud-vue#200 (manifest schema extensions: widget-ref, roleAware, visibleIf.appInstalled) — REQUIRED for nextcloud-app + dashboard specs (manifest renderer support)

Hydra's dependency check should hold this issue at ready-to-build until both umbrellas close. When they do, Hydra picks up the issue and dispatches the builder.

Out of scope (for v0.1 wedge)

• The other 8 specs at idea status (assessment-engine, proctoring, grading-pta, opp-cycle, bron-rod-exchange, oso-transfer, absence-leerplicht, identity-federation) — Phase 2-5.

Companion context

• Context brief: scholiq-context.md
• Wedge plan: WEDGE-PLAN.md
• Architect review: scholiq PR chore: realign scholiq specs + ADRs + ARCHITECTURE.md with ADR-022 / ADR-024 / ADR-031 (declarative-first) #20 — verdict APPROVE WITH DEFERRED-QUESTIONS (resolved by the two umbrellas above)

[rubenvdlinde]

Wedge spec built + merged. Implementation tracked in PR #28 (nextcloud-app shell) / #30 (course-management) / #31 (enrolment) / #33 (compliance-audit) / #34 (certification) / #32 (dashboard) and the fix PRs #37/#40/#42. The capability spec at openspec/specs/{...}/spec.md is marked status: implemented; the strict change is at openspec/changes/archive/. Closing this ready-to-build tracking issue.